refactor: move visibility of providers to `defs.bzl`

We keep file visibility hidden and only expose the minimal set of
symbols downstream. This is to reduce our API surface area to
maintain.